Validate tool requests on the server
Check the authenticated user, resource ownership, allowed action, and parameters. A well-formed tool call can still target the wrong account. Never rely on the browser or the model to assert that an operation is authorized.
Approve the actual payload
Bind approval to the concrete action, destination, and relevant content. If those change, reassess approval. Avoid a generic “yes” that can be reused for unrelated requests or a payload silently modified after review.
Minimize and monitor exposure
Classify the data, define retention, redact unnecessary sensitive fields, and protect logs. Record enough to investigate incidents without turning observability into a second uncontrolled data store. Test denial and escalation paths as carefully as the happy path.
A worked example
Invalidate the prior approval and require review of the new recipient and message. Validate the send request at execution time against the approved action.
The point: Approval belongs to a specific action, not to everything the assistant does next.
Before you take the exam
Explain these concepts in your own words, work through a different example, and describe why the tempting alternatives fail. Use the references to go deeper.